UBUNTU-CVE-2021-22212: ntpsec Ubuntu
Vulnerability summary
UBUNTU-CVE-2021-22212 is a high (CVSS 7.4) vulnerability in ntpsec Ubuntu.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-06-2021PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters. ntpd then either pads, shortens the key, or fails to load these keys entirely, depending on the key type and the placement of the '#'. This results in the administrator not being able to use the keys as expected or the keys are shorter than expected and easier to brute-force, possibly resulting in MITM attacks between ntp clients and ntp servers. For short AES128 keys, ntpd generates a warning that it is padding them.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- ntpsecAll versions (No fix recorded)
1 vendor · 1 product